Login through RADIUS is not working due to invalid shell by saravanan-i · Pull Request #13141 · sonic-net/sonic-buildimage

saravanan-i · 2022-12-22T09:53:30Z

Why I did it

RADIUS presumes that sonic launch shell (/usr/bin/sonic-launch-shell) is available by default to be authenticated users, which is not the case. This leads to failure in RADIUS authentication.

How I did it

Added valid bash shell (/bin/bash) in RADIUS nss code

How to verify it

Verification of remote RADIUS user with valid credentials is authenticated without any failure - PASS

Which release branch to backport (provide reason below if selected)

Description for the changelog

Fixed RADIUS user authentication issue due to invalid shell (sonic-launch-shell)
Resolves

This pull request resolves PR#11352 (#11352) under sonic-buildimage repository.

Root-Cause: RADIUS presumes that sonic launch shell (/usr/bin/sonic-launch-shell) is available by default to be authenticated users, which is not the case. This leads to failure in RADIUS authentication. What I did: Added valid bash shell (/bin/bash) in RADIUS nss code

DavidZagury · 2023-01-08T14:09:58Z

Looks good to me. However, in the triage meeting where we first discussed this issue, we asked BRCM to check the reason it was first built with that shell.
I don't think we got a answer about that.

@zhangyanzhao did BRCM check that? can we conclude that the shell really is wrong and we can change it? if so, this PR should fix the issue.

dharmaraj-gurusamy

Looks good to me. @lguohan / @zhangyanzhao - Please review.

liat-grozovik · 2023-03-13T11:45:08Z

@lguohan @qiluo-msft would you please help to approve this fix? it is needed for 202211

keboliu · 2023-04-08T05:58:31Z

@qiluo-msft would you please help to review and approve?

lguohan · 2023-04-13T21:17:38Z

THIS PR also claims fix #11352

#14466

can we get clarification? which pr fix? which one to go?

keboliu · 2023-04-16T09:47:23Z

THIS PR also claims fix #11352

#14466

can we get clarification? which pr fix? which one to go?

@saravanan-i would you please clarify?

saravanan-i · 2023-04-18T04:23:50Z

THIS PR also claims fix #11352
#14466
can we get clarification? which pr fix? which one to go?

@saravanan-i would you please clarify?

This PR has corrected the invalid soft link ("sonic-launch-shell") to valid RADIUS login launch shell("/bin/bash"). Other authentication protocols like TACACS use this shell ("/bin/bash") in SoNIC. Link to TACACS code which use the shell ("/bin/bash") TACACS_Link_shell

zhangyanzhao · 2023-06-13T04:21:50Z

@adyeung can you please help to review this PR? Thanks.

Yarden-Z · 2023-06-27T19:02:19Z

src/radius/nss/libnss-radius/nss_radius_common.c

@@ -159,11 +159,11 @@ static void init_rnm(RADIUS_NSS_CONF_B * conf) {
    rnm[0].gid   = 999;
    rnm[0].groups = "docker";


To reduce the attack surface, maybe change the default group given here.
MPL = 0 user does not require docker, but maybe it does require the redis group or adm group.

Hi @Yarden-Z . They were defined as per the existing RADIUS design document of SoNIC ( RADIUS_Design ). I haven't introduced them as part of this pull request. Can you please confirm if you have to change the same ?

I understand that these values were introduced in the HLD design.
But given this item - I think we can re-visit this.
From my perspective, a non-privileged user requires redis (potentially) and the default adm group.
If I understood your question

qiluo-msft · 2023-06-27T20:15:10Z

src/radius/nss/libnss-radius/nss_radius_common.c

@@ -159,11 +159,11 @@ static void init_rnm(RADIUS_NSS_CONF_B * conf) {
    rnm[0].gid   = 999;
    rnm[0].groups = "docker";


The readonly user should be in users group, and no docker group membership. #WontFix

Hi @qiluo-msft. User groups were defined based on existing RADIUS design document of SoNiC RADIUS_Design. I haven't introduced them as part of this pull request. Can you please confirm if we have to modify the same ?

@saravanan-i I think we should remove this docker group because the sudoer file already allows for the read-only docker commands. Adding docker group allows this user to potentially do non-read_only things. I can push that change if you want to give me access to this branch so we can keep all the history of this PR without having to make a new one.

Summary: This is the HLD for the RADIUS test that is currently running as part of this PR: #16475 Also, note that before these tests pass in the pipeline, this PR needs to be merged into sonic-buildimage sonic-net/sonic-buildimage#13141.

Summary: This is the HLD for the RADIUS test that is currently running as part of this PR: sonic-net#16475 Also, note that before these tests pass in the pipeline, this PR needs to be merged into sonic-buildimage sonic-net/sonic-buildimage#13141.

Why I did it This is a follow up to #13141, to include removing the docker group add for the RO user for RADIUS. The sudoer file already allows docker ps command

Summary: This is the HLD for the RADIUS test that is currently running as part of this PR: sonic-net#16475 Also, note that before these tests pass in the pipeline, this PR needs to be merged into sonic-buildimage sonic-net/sonic-buildimage#13141. Signed-off-by: opcoder0 <[email protected]>

Summary: This is the HLD for the RADIUS test that is currently running as part of this PR: sonic-net#16475 Also, note that before these tests pass in the pipeline, this PR needs to be merged into sonic-buildimage sonic-net/sonic-buildimage#13141. Signed-off-by: Aharon Malkin <[email protected]>

Summary: This is the HLD for the RADIUS test that is currently running as part of this PR: sonic-net#16475 Also, note that before these tests pass in the pipeline, this PR needs to be merged into sonic-buildimage sonic-net/sonic-buildimage#13141. Signed-off-by: Guy Shemesh <[email protected]>

saravanan-i changed the title ~~Issue Description: Login through RADIUS is not working~~ Login through RADIUS is not working due to invalid shell Dec 22, 2022

saravanan-i marked this pull request as ready for review December 22, 2022 10:22

saravanan-i requested a review from lguohan as a code owner December 22, 2022 10:22

saravanan-i mentioned this pull request Dec 22, 2022

[Radius] Fail to login to switch when Radius is configured "shell /usr/bin/sonic-launch-shell does not exist" #11352

Open

saravanan-i changed the title ~~Login through RADIUS is not working due to invalid shell~~ Draft: Login through RADIUS is not working due to invalid shell Dec 23, 2022

saravanan-i marked this pull request as draft December 23, 2022 08:45

Removed unrelated changes

84f2fa6

saravanan-i marked this pull request as ready for review December 23, 2022 13:31

saravanan-i changed the title ~~Draft: Login through RADIUS is not working due to invalid shell~~ Login through RADIUS is not working due to invalid shell Dec 23, 2022

liat-grozovik added the Request for 202211 Branch label Jan 11, 2023

dharmaraj-gurusamy approved these changes Jan 20, 2023

View reviewed changes

DavidZagury approved these changes Feb 26, 2023

View reviewed changes

keboliu requested a review from qiluo-msft April 8, 2023 05:57

dharmaraj-gurusamy mentioned this pull request Apr 18, 2023

Add sonic-launch-shell to invoke appropriate shell based upon user's … #14466

Open

8 tasks

zhangyanzhao requested a review from adyeung June 13, 2023 04:22

Yarden-Z reviewed Jun 27, 2023

View reviewed changes

qiluo-msft reviewed Jun 27, 2023

View reviewed changes

gx1010 mentioned this pull request Dec 11, 2024

[RADIUS]Login fails. triggering six sshd processes to login device with same username and password at the same time, only one process login successfully. #21130

Open

dt-nexthop mentioned this pull request Apr 28, 2025

[Testplan] RADIUS tests sonic-net/sonic-mgmt#18153

Merged

5 tasks

dt-nexthop mentioned this pull request Jun 11, 2025

Fixing RADIUS invalid shell #22933

Merged

7 tasks

yxieca pushed a commit that referenced this pull request Jun 12, 2025

Fixing RADIUS invalid shell (#22933)

79e5d74

Why I did it This is a follow up to #13141, to include removing the docker group add for the RO user for RADIUS. The sudoer file already allows docker ps command

		@@ -159,11 +159,11 @@ static void init_rnm(RADIUS_NSS_CONF_B * conf) {
		rnm[0].gid = 999;
		rnm[0].groups = "docker";

Conversation

saravanan-i commented Dec 22, 2022

Why I did it

How I did it

How to verify it

Which release branch to backport (provide reason below if selected)

Description for the changelog

This pull request resolves PR#11352 (#11352) under sonic-buildimage repository.

Uh oh!

DavidZagury commented Jan 8, 2023

Uh oh!

dharmaraj-gurusamy left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

liat-grozovik commented Mar 13, 2023

Uh oh!

keboliu commented Apr 8, 2023

Uh oh!

lguohan commented Apr 13, 2023

Uh oh!

keboliu commented Apr 16, 2023

Uh oh!

saravanan-i commented Apr 18, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zhangyanzhao commented Jun 13, 2023

Uh oh!

Yarden-Z Jun 27, 2023

Choose a reason for hiding this comment

Uh oh!

saravanan-i Jul 18, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Yarden-Z Jul 27, 2023

Choose a reason for hiding this comment

Uh oh!

qiluo-msft Jun 27, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

saravanan-i Jul 18, 2023

Choose a reason for hiding this comment

Uh oh!

dt-nexthop May 12, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

dharmaraj-gurusamy left a comment •

edited

Loading

saravanan-i commented Apr 18, 2023 •

edited

Loading

saravanan-i Jul 18, 2023 •

edited

Loading

qiluo-msft Jun 27, 2023 •

edited

Loading